Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
222
questions
0
votes
0
answers
198
views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
- 143
1
vote
1
answer
513
views
How to calculate value inside stack segment (SS)
I have an assembly row which the following information:
EBP = 006FFB50
SS = 002B
When I looked on this row:
mov eax,dword ptr ss:[ebp+8]
I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58.
But ...
- 583
0
votes
1
answer
2k
views
How to view the functions of a loaded library in x64dbg
I am working on a packed file with UPX.
In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0.
The debugger auto-completes it to kernel32.LoadLibraryA.
Where can I ...
- 583
0
votes
0
answers
318
views
What's the reason for a program to crash every time a breakpoint is set in x64dbg?
I know this question may be an ambiguous one and so may not be straightforward, so I apologize for that. Nevertheless, I believe that anti-debugging is responsible for the constant crashing of the ...
- 115
0
votes
0
answers
2k
views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
- 1
1
vote
1
answer
317
views
How can I easily convert little endian pointers in hex dumps?
I am tracking down a data structure whose address is inside the second operand:
mov rcx, qword ptr ss:[rbp+E0]
When I look at the value of [rbp+E0] I see the following dump:
21 C4 FC 5E 00 00 00 00
...
- 23
1
vote
0
answers
136
views
Set a breakpoint for a win command without an address
How to make these columns empty or make a new breakpoint where they are empty? I just need a stop at these win commands (in the summary column), not at a specific address.
I don't know what exactly ...
- 163
0
votes
1
answer
54
views
How to whitelist an address for breakpoint?
If I have breakpoint on some win function, how to whitelist some address on which I don't want stopping?
Seems that it is needed to use conditions. How?
I use x64dbg, but if you only know a way in ...
- 163
2
votes
0
answers
293
views
x64dbg break when hex string is loaded
I'm trying to break execution when a string is loaded in memory.
I can´t find the string by using the search for -> string references
So I press Alt + M and press Ctrl + B to search my string ...
2
votes
1
answer
2k
views
x64dbg, breakpoint on write in memory with specific value
In x64dbg, we can set hardware breakpoint on write in memory dump but can we add more codition?
Ex. Set breakpoin on write of value of 2F.
- 21
1
vote
1
answer
1k
views
x64dbg throwing exception
I have been working on finding an overflow in WordPad and I was able to run an exception with an undefined behavior (my point of view).
I am using x64dbg (I am not a pro x64dbg) and it shows ...
- 125
2
votes
2
answers
1k
views
Dealing with obfuscated PUSH PUSH RET instructions
I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
- 153
1
vote
1
answer
764
views
How to log CPU instructions executed by program with x64dbg?
How to log CPU instructions executed by program with x64dbg?
I saw x64dbg - see the current position? question, but I can't find the way to log instructions.
Thanks!
- 11
1
vote
1
answer
87
views
How's this code able to make use of the stack?
I am trying to reverse engineer software to extend its functionality as expected of me. So I don't have the source code with me. Anyways, I am used to seeing codes that start like the one below, and ...
- 115
-2
votes
1
answer
4k
views
Debug and crack .NET executable PE
i'm trying to learn reverse engineering for penetration testing my codes and i believe i won't learn unless i can do some practical so
I'm trying to crack an application that is written in C# and all ...
- 101
2
votes
0
answers
825
views
Recommended plugins for x64dbg
I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks.
The more you can ...
- 86
0
votes
1
answer
1k
views
Patching memory
I've successfully reversed and patched an application on windows, but patching the executable on disk triggers a CRC check and prevents it from loading. I've used x64dbg and have the addresses I need (...
1
vote
0
answers
65
views
How to ret with jxx in x64dbg's sciprt
main:
call foo
call bar
ret
foo:
// code
cmp $number, 0
je ret
// code
ret
bar:
// code
cmp $number, 0
je ret
// code
ret
I would like to ...
- 131
0
votes
0
answers
96
views
Tracing back the user code section that triggered a message
I have a Windows GUI x86 executable and I have identified, in the .rsrc section, where the error string I want to trace is. Let's assume it is in id=83Ah.
I have set a bpx user32:LoadStringA and then ...
- 319
0
votes
0
answers
280
views
Reversing WSASend finding functions that called it
I'm trying to make my first DLL calling game functions
What I need is tracing functions that call WSASend, so it will be easy for me to get all functions address to call them from my DLL.
What I ...
- 161
2
votes
2
answers
282
views
Function Prologue, add esp directive
I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:
push ebp ;...
- 23
2
votes
1
answer
277
views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
- 131
6
votes
3
answers
2k
views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
- 111
0
votes
1
answer
229
views
xor eax,3 why does the input change the way it does?
I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
- 111
1
vote
2
answers
584
views
Patched Application causes Acces Violation c0000005
I've been working with this application to remove it's trial limitations.
But every byte I change, it throws an acces violation.
Piece of the code:
Original:
003354C6 - 0F85 D3000000 - jne ...
1
vote
0
answers
774
views
x64dbg "Use Graph command or menu action to draw control flow graph here..."
When I press "G" in the CPU view of the debugger I often get the following screen:
In what cases can this error message happen? Obviously I can't yet give an exact way to reproduce it, I'm curios ...
- 131
1
vote
1
answer
392
views
Dump array of char* ASCII text to file? (ollydbg or x32dbg)
This question is similar to: List arrays (de-reference pointers) in Ollydbg
I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...
- 11
0
votes
2
answers
921
views
How to compare two different executions of the same file?
When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
- 1
2
votes
1
answer
789
views
change compare function in assembly and .exe stopped working x64dbg
I'm trying to bypass (crack) a very old software that require license in order to unlock all the features
i was digging in the lines with a little bit of knowledge in assembly
and i found the line ...
- 47
2
votes
1
answer
2k
views
bypass license of very old software, Access violation (C0000005) x32dbg
I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license
so, with a little bit of knowledge in ...
- 47
0
votes
1
answer
250
views
Nop the string in online games
So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn
My question is how is that possible? I just edit ...
- 9
2
votes
1
answer
4k
views
x64dbg: break when a register contains a value
Is there a way to break code execution when a register contains a particular value with x64dbg? I'm not talking about setting a conditional breakpoint at a specific location, but about watching the ...
0
votes
1
answer
222
views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
- 203
0
votes
1
answer
8k
views
How to use memory address information from IDAFree to set a breakpoint in x32dbg?
I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
- 233
0
votes
2
answers
723
views
What's ScyllaHide's PDBReaderx64.exe Doing?
I just downloaded the binary of ScyllaHide for x64dbg. According to the instructions, I need to generate an NtApiCollection.ini file by running PDBReaderx64.exe or PDBReaderx86.exe. But I've got a ...
- 103
2
votes
1
answer
351
views
Detailed API call descriptions not available in x64dbg
I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying !
There is an example from the two ...
- 89
1
vote
1
answer
1k
views
cannot find a string in x64dbg even when using search all strings
I am trying to debug a program for testing but for some reason i can NOT find any strings related to registeration like Registered, Unregistered,Blocked in x64dbg, i can see all these strings in the ...
- 11
2
votes
1
answer
972
views
How to navigate Disassembly view to the current instruction location?
I'm using x32dbg and I've set a hardware memory breakpoint. It triggers successfully for a specified module and the debugger pauses and a message on the bottom says:
Hardware breakpoint (byte, read/...
- 123
2
votes
2
answers
676
views
Find a instruction in a binary file (PE) based on a virtual address of a string reference
English is not my first language, so I'm sorry if my text isn't so clear.
I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
- 23
5
votes
1
answer
1k
views
Is it possible to view and modify process memory without attaching the debugger in x64dbg?
This functionality is available in Cheat Engine where the debugger won't be attached until you set a breakpoint or explicitly ask for the debugger to be attached. I've looked everywhere and couldn't ...
- 53
1
vote
1
answer
229
views
Find Retdec Address Range in x64dbg
How do I find this function from RetDec in x64dbg?
// Address range: 0x1017dba0 - 0x1017dbda
int32_t function_1017dba0(int32_t * a1) {
int32_t fileHandle = (int32_t)CreateFileA("\\\\.\\...
- 111
1
vote
0
answers
2k
views
In X64dbg, how can I script a string write to memory?
I find that I can write to memory as
[addr] = value
As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html
And while I could work around my problem as dividing ...
- 11
1
vote
2
answers
2k
views
Difference between 32 bit and 64 bit disassemblers
As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
- 15
2
votes
1
answer
414
views
How to hide a process from all the methods of getting the list of processes?
So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not
so these are the ways i know :
...
- 518
1
vote
1
answer
196
views
What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)
So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
- 518
1
vote
1
answer
294
views
Getting started with RE, with eventually goal being able to make a keygen [closed]
I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
- 11
3
votes
2
answers
3k
views
When trying to change command line, received an error: "Could not set command line!"
I download CurrPort program and run it on xdbg64.
I pressed File -> Changed Command line and changed the command line to:
"C:\Users\myusername\Downloads\cport\cports.exe" "/close * * 127.0.0....
- 583
1
vote
0
answers
458
views
UTF8, UTF16 encoding string search
I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them..
P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
2
votes
1
answer
1k
views
Finding out what calls win32u.dll functions
There's a button which, when clicked, writes some data to the clipboard.
I'm trying to call the function this button executes using DLL Injection.
I managed to find the function in win32u.dll which ...
- 153
1
vote
2
answers
4k
views
x64dbg (x32dbg) log registers every step like windbg
So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
- 11